I downloaded Splunk 4 a couple of months ago when it came out because I decommissioned the box that my original Splunk version was on (and changed OS’s – see my battle with FreeBSD and Splunk in earlier posts) and I needed to download the package again. At the time, there was no free license available. Actually, I didn’t realise that when I downloaded it, and I wound up with a 60 day enterprise trial license. I didn’t do anything with it that I didn’t do with the old 3.x free license, as in, I didn’t index any more data and the authentication actually just annoyed me (I’m the only user).

Anyway, it expired after 60 days a the beginning of October, and there was still no free license available, so I stopped using it. At the end of October (27th), Splunk released a free license verison. Unfortunately, they provided no instructions on going from the trial to the free license version. The marketing release mentioned that 3.x enterprise users should contact sales for upgrades, and 3.x free users should read the documentation. Unfortunately, all the documentation said was that the 3.x license wouldn’t work with 4.x, and the rest of the documentation referred to the old Splunk version. Nothing indicating how to upgrade from 3.x to 4.x free license, or trial to free license conversion.

I sent sales an email and got a response back saying “Hey, thanks for using Splunk, go read our marketing release”. I’m thinking, yeah, I did that already, that’s kind of why I emailed you… Oh well. Anyway, I’ve been trying to move all these beta monitoring servers into production,so I wanted to get Splunk working. I poked around in the directories and discovered /opt/splunk/etc/splunk.license. Renaming it so that the program couldn’t find it didn’t really work; Splunk stil said my license had expired. I wound up being ready to ditch my existing database and just install a fresh copy if necessary, but first I was going to see if I could install the new version, rip the free license file out of it manually now I knew where to find it, and put it in my old directory. Because I’m using Debian / Ubuntu, when I installed the new package version, it automatically deteted an upgrade. Ok, there goes my idea of manually copying the file, I should have gone with the tarball..however, because I’d renamed the license (or maybe it does this anyway, I’m too lazy to reinstall it now it works), the upgrade installed all of the licenses and upon the first run prompted me to agree to the license agreement for a free license. Woohoo! Working Splunk. And it kept all my data that had been indexing from the Enterprise trial.